Eight eMudhra certificate keys were so weak that one was the number 4
Chrome, Firefox, Apple and Microsoft have blocked the eMudhra certificates, which let anyone forge trusted certificates for any website. Linux distributions, developer tools and devices are still catching up.
Via TNW | Data-security
Anyone could calculate the private keys of eight eMudhra intermediate certificates from the certificates themselves. eMudhra is a certificate authority based in India. Anyone holding the keys could issue a certificate for any website that browsers and apps would accept.
A researcher credited only as Wayne reported the problem to the browser root programs on Saturday, 17 October. As proof, Wayne signed the message “We have a problem here – Wayne” with each of the eight keys. That is according…
Courtesy
This story was originally published by TNW | Data-security. All rights belong to the original publisher.
Read the original on thenextweb.com ↗